VulnHub

Real-time Cybersecurity News

Critical

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The Hacker News
Actively Exploited
CVEZero-dayExploitVulnerabilityPatchCriticalOracle

Overview

A recently reported vulnerability in Oracle PeopleSoft, exploited by the cybercrime group ShinyHunters since May, is actually a combination of three flaws working together. Researchers identified the root cause as a server-side request forgery (SSRF) that allows access to an internal management interface due to PeopleSoft's trust in its own loopback address. Oracle addressed these vulnerabilities in June with a patch identified as CVE-2026-35273. This situation is concerning because it highlights how attackers can chain multiple flaws to exploit systems effectively. Organizations using affected versions of PeopleSoft should ensure they apply the latest patches to protect against potential breaches.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Oracle PeopleSoft, CVE-2026-35273
  • Action Required: Oracle released a patch for all three vulnerabilities under CVE-2026-35273 in June 2023.
  • Timeline: Ongoing since May 2023

Original Article Summary

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

Impact

Oracle PeopleSoft, CVE-2026-35273

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since May 2023

Remediation

Oracle released a patch for all three vulnerabilities under CVE-2026-35273 in June 2023. Users should apply this patch to their PeopleSoft systems to mitigate the risks associated with these vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Zero-day, Exploit, and 4 more.

Read Original Article

Related Coverage

Oracle EBS exploitation similar to Clop's MOVEit, GoAnywhere attacks

SCM feed for Latest

The Clop ransomware group has shifted its focus from exploiting file transfer tools to targeting legacy business systems like Oracle EBS. This change signifies an evolution in their attack strategy, posing a significant threat to organizations using these systems due to potential data breaches and operational disruptions.

Dec 1, 2025

Dartmouth College Confirms Data Theft in Oracle Hack

SecurityWeek

Dartmouth College has confirmed a significant data breach involving the theft of over 226 Gb of files by cybercriminals. This incident highlights the increasing risks associated with data security in educational institutions and raises concerns about the potential exposure of sensitive information.

Nov 26, 2025

Canon Says Subsidiary Impacted by Oracle EBS Hack

SecurityWeek

Canon has reported that one of its subsidiaries has been affected by the Oracle EBS hack, which has resulted in over 100 alleged victims being listed on the Cl0p ransomware website. This incident highlights the significant impact of the Oracle EBS campaign and raises concerns about the security of affected organizations.

Nov 25, 2025

Critical Flaw in Oracle Identity Manager Under Exploitation

darkreading

The article highlights the exploitation of CVE-2025-61757, which follows a breach of Oracle Cloud and an extortion campaign targeting Oracle E-Business Suite customers. This indicates a significant security threat that could impact numerous organizations relying on Oracle's services.

Nov 24, 2025

CISA Confirms Exploitation of Recent Oracle Identity Manager Vulnerability

SecurityWeek

CISA has confirmed the exploitation of a vulnerability in Oracle Identity Manager, identified as CVE-2025-61757, which has been added to its Known Exploited Vulnerabilities catalog. This indicates a significant security risk for organizations using the affected systems, necessitating immediate attention to mitigate potential breaches.

Nov 24, 2025

Mazda Says No Data Leakage or Operational Impact From Oracle Hack

SecurityWeek

Mazda has been identified as a victim of the Cl0p ransomware group's Oracle EBS campaign, but the company asserts that there has been no data leakage or operational impact from the incident. This situation highlights the ongoing threat posed by ransomware groups targeting enterprise systems.

Nov 24, 2025